Re: To trust or not to trust???

Hi Jmos,
The underlying issue is one of trust. Not AD trusts mind :-)
Do you trust the way the partner forest is managed? Looks like, from what I'm reading, they don't exactly trust you and want to delegate an OU in their forest for you to manage your resources in.

I would have thought, if you had WS03 domains, that a forest trust would have been easier to setup/manage than a migration of your resources into an OU in their forest.
Also, if you do do the migration to an OU in the partner forest, why should the migrated Admins be domain Admins? No need really. They can have delegated responsibilities at the OU level.

There are no hard and fast technical reasons that determine which way you should go wrt their forest or yours.
The political decision IMHO should be sorted out then the technical solution will follow.

Regards,

Austin


"jmos" <jmos@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:EE504811-A103-43AA-8823-0D617B20D982@xxxxxxxxxxxxxxxx
We currently have two companies which need to merge but a difference of
opinion and I could do with another view.

As a standard practice I want to setup a trust between both forests so that
resources can be easily accessed from each other domain without too much
issue. This buys the IT depts from both sites time to align AD's over a 9
month period.

However, their IT dept don't want to do that as 'it's too much work' and
'more complicated'. Thus their suggestion is that they send us a DC
configured in their domain and we migrate our AD into a subset OU of theirs.

Obviously block inheritance would be a must and both sets of Admins would
have to have access at Domain Level.

I'm not convinvced and want a more stable and stage approach to the merger
of the two entities.

Can anyone offer andy help or advice on this issue?

Many Thanks

JMOS

.

Relevant Pages

  • Re: creating one way trust
    ... of different forest. ... It sounds for me that you do not need/have a trust, ... Once everything is replicated from the win2k svr. ... Let me try to understan a little more about youre network. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Huge AD deployment
    ... That was the case in Windows 2000, but in Windows Server 2003 forest trusts ... note though is that a forest trust is only transitive for domains within the ... >> company.com in that data center and have every country trust company.com ... instead of going over the internet. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain Functional Levels and Trusts
    ... other type of trust, i.e., Forest Trust ... A Forest Trust and an External trust are TWO DISTINCT types ... FORESTS to be in Win2003 Forest Functional Level. ... External trusts are possible in any MODE, ...
    (microsoft.public.windows.server.active_directory)
  • RE: Two way forest trust fails only in one direction
    ... After deep research of the SMB signing, we saw that both servers need Reg Key: ... needed to match on both servers on both sides of the trust. ... B's Forest, but Company B can not access Company As forest at all. ... running DNS and WINS under Windows Active Directory. ...
    (microsoft.public.windows.server.active_directory)
  • Re: admt and virtual pc
    ... are both 2003 and the same forest there should be a default implicit trust. ... ADMT but you don't actually say that and more importantly ... ADMT requires the Source Domain ...
    (microsoft.public.windows.server.active_directory)